# SZB-56bfa02295: Trojanized CWP web server reportedly spreads CWPdoor Linux backdoor

BleepingComputer reports that a new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface.

- Type: Early warning
- Kind: Malicious package
- Vendor: Control Web Panel
- Product: cwpsrv
- Status: Reported, not confirmed
- Sources: 2 distinct
- First seen: 2026-11-05 16:26 UTC

> No statement or filing from Control Web Panel has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

BleepingComputer reports that a new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface. The report describes the backdoor as hitting Linux servers, and the item does not say how many systems are affected.

## What to do

- Verify the cwpsrv binary against a known-good copy from the vendor
- Update Control Web Panel to the latest release
- Hunt for CWPdoor indicators on servers running CWP
- Restrict access to the CWP management interface

## Timeline

- 2026-11-05 16:24 UTC: Made public by BleepingComputer
- 2026-11-05 16:26 UTC: First seen by cve.now

## Evidence (2 sources)

- 2026-11-05 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/): “A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@cyberseckyle/117565018010183565): “QiAnXin XLab reports CWPdoor, a backdoor built into the cwpsrv binary used by Linux Control Web Panel.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-56bfa02295&body=https%3A%2F%2Fcve.now%2FSZB-56bfa02295%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-56bfa02295

### Has Control Web Panel confirmed it?

BleepingComputer and Mastodon report it. No statement from Control Web Panel has reached cve.now yet.

Source: https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/, https://infosec.exchange/@cyberseckyle/117565018010183565

### What should Control Web Panel users do?

Verify the cwpsrv binary against a known-good copy from the vendor. Update Control Web Panel to the latest release. Hunt for CWPdoor indicators on servers running CWP. Restrict access to the CWP management interface.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-56bfa02295
Site guide for agents: https://cve.now/llms.txt